Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Windows Process With NamedPipe CommandLine

Process Injection

Disabling NoRun Windows App

Disable or Modify Tools, Impair Defenses, Modify Registry

WBAdmin Delete System Backups

Inhibit System Recovery

Windows Privilege Escalation User Process Spawn System Process

Exploitation for Privilege Escalation, Abuse Elevation Control Mechanism, Access Token Manipulation

Windows Get-AdComputer Unconstrained Delegation Discovery

Remote System Discovery